Re: [gentoo-server] requirements for a more stable portage tree

[Sebastien Arnaud]

For some reason I keep having this vision in my head...

1. Quarterly updates of the tree. Gentoo Server would maintain 2 
different server tree, one for the current quarter and one for the 
previous quarter. That does not seem to excessive to a maintain. One 
could specify with tree they want to use (current or delayed)

2. When using emerge, one would have the option to specify a filter 
that would upgrade only the packages on my system that are security 
related. Something like "emerge -u world --security-only-updates". From 
an administrator point of view, this would be executed "often" to 
insure that public exposed servers are patched against vulnerabilities 
immediately.

3. Finally, the ability to archive on the local machine (or rsync local 
server) the ebuilds. So that every-time any package is updated the 
previous ebuild is archived (tar gzip) somewhere on the local system, 
to allow even to revert to the previous ebuild if the upgrade happens 
to break things.
The opportunity to archive the complete tree and ebuilds on the local 
machine prior to the quarterly updates would be nice too...

Hope this rather simplistic approach helps the discusssion.


Regards,

Sébastien


On Feb 12, 2004, at 04:21, Eric Sammer wrote:

> The problem with this approach is that you don't benefit from security
> updates and if you try and update only portions of the "frozen"
> internal tree, well, you're going to be fighting to say the least.
>
> This is what a number of users who need a frozen tree do now and it's
> proving to be way too much overhead. In theory, the admin maintaining
> the internal tree is doing the work the Gentoo security team and the
> arch maintainers are doing anyway, by themselves.
>
> Most of the users doing this are doing so because we don't have a
> frozen tree and, in most cases, 190+ pairs of eyes are better than 1.
> :)